01
What Sanctor is
Sanctor keeps a private record of your agreements and of every decision made under them. Your agreements become a book of rules. Every decision, fact and appointment is written to the record only when the people the rules name have signed it.
An AI reads the book for you. Ask it whether something is allowed and it answers once, with the rule, who must sign, and when the matter closes. It never decides and it never signs. Only signatures write to the record.
Three things follow from this, and everything in the product is one of them.
The book. Your agreements, compiled into numbered provisions. Every provision has a version, a date, and the signatures that adopted it. Change one and the old words stay on the record as history.
The record. One ordered list of entries. Each entry carries a hash of the one before it, so nothing can be rewritten without it showing. Everything else you see in Sanctor, the registers, the cap table, who holds which seat, is computed from this list and never stored separately.
Matters. A decision or a fact on its way to the record. It opens with a question, gathers versions and signatures, and closes once, as sealed, refused, lapsed or withdrawn.
There is no administrator. Nobody at Sanctor, and nobody in your workspace, can sign, adopt or delete on anyone's behalf. A seat is filled because a rule says who may fill it.
02
Start a workspace
A workspace is one record for one relationship. A company, a trust, a fund, a joint venture, a partnership between two people. Make as many as you need. They never share anything.
Founding. A workspace begins with the founders, how many of them must sign, and how long a matter stays open before it lapses. That is all. There are no rules yet and no seats. The founding is the first entry on the record and the only one not authorised by a rule, because there is no rule yet to authorise it.
The first agreements. Drop your governing documents on the Desk. Bylaws, an operating agreement, a shareholders agreement, a partnership deed. Sanctor hashes each file, extracts its words onto the record, and hands the file back. The compiler turns the words into numbered provisions and shows you the result as a draft. You read it, cut what you do not want, and send it. The founders sign and the book exists.
Seats. Once the book names a seat, an Officer, a Director, a Treasurer, someone fills it by binding a person to it under the rule that allows it. The person accepts by signing. Until then the seat is empty, and the book says so.
After that the founders are ordinary signers like anyone else. They keep whatever the book gives them and nothing more.
Switching. The chip above the menu names the workspace you are in. Click it to switch. The Desk and Matters show every workspace at once, the Book, the Record and People & roles show the one you have selected.
03
The Desk
The Desk is where your day starts. It shows everything open that is waiting on you, nothing else, and a box to ask the book a question.
For today. One row per matter, sorted by what closes soonest, overdue first. The left column says Decision or Fact. The second line says what is waiting, your signature, your confirmation, a question someone asked you, a draft you have not sent, or a date you owe. Click a row and the matter opens. The first row is already selected when you arrive.
Use the arrows beside the date to look at yesterday or tomorrow. A past day shows what was on your Desk that morning and what became of each item, sealed with its entry number, refused, lapsed, or still open. A future day shows what closes then.
Ask. Type a question in plain words. May we pay the vendor $18,400? We signed the lease on Friday. Who can approve a hire? The book answers once. It names the provision, who must sign, and when the matter will close. It does not talk back and it does not argue. If you want to act on the answer, press Act on the Ask and a draft opens for you to write.
The book can give three answers. Allowed alone, so you can do it yourself and one signature seals it. Yes with signatures, so a matter opens for the people named. The book is silent, so no provision speaks to it, and the fact can still be recorded for the people it concerns to confirm.
Drop a document. Drop a file anywhere on the Desk. It is hashed, its words are extracted, and the file is handed back. What happens next depends on what it was. A contract becomes a draft of provisions. An invoice or a signed letter becomes a fact for the people concerned to confirm.
04
Matters
A matter is a decision or a fact on its way to the record. Every matter has the same page. The left side is the stream, the conversation and everything that happened. The right side is what is on, or about to go on, the record.
Two kinds. A Decision is something the rules allow and the named signers approve. A Fact is something that happened and the people it concerns confirm. The book tells you which one you have from the question you asked, and you can switch it before you send if the book guessed wrong.
The header. The title, the book's answer in one sentence, and a chip that reads the same way everywhere. Decision · Gene, Peter · 0 of 2 · §12. The kind, who must sign, how many have, and the provision it rests on. The link icon beside it opens the chain of authority.
Drafts. Press Act on the Ask, or Send from the stream, and a private draft opens on the right. v1 · You · closes 24 Oct. Nobody else can see it. Write the decision in words, or let the book draft it from the discussion with New draft from discussion. When it is ready press Send.
Send. Send is the only verb. Before anything goes out, Sanctor checks the draft against the book and shows you a stamp. Decision or Fact, the provision, the signers locked from the rule, the threshold, the close date. If the draft would change a rule, the stamp says so and routes it to that rule's door as a separate matter. Confirm and the version enters the stream, the matter gets its number, and the people named see it on their Desk.
Versions. Every send is a new version, v1, v2, v3. A version never replaces an earlier one. They sit side by side as candidates, and each has its own page you can link to. A link is not a permission. Whoever opens it sees only what the rules let them see.
Signatures. A signer presses Approve or Refuse on a decision, Confirm or Dispute on a fact. The first signature on a version commits it. Until a version seals, a signer can move their signature to a different version or withdraw it. The first version to reach the threshold seals, and its siblings are marked superseded. If you are the only signer the rule names, Approve seals in one press.
How a matter ends. Once, and one of five ways.
A sealed decision is never edited. To change it, open a new decision that varies or reverses it, under the rule that allows that.
Discussion. Anything written in the stream before a version is sent is discussion. It is kept with the matter, but it is not on the record and nobody signs it. A matter with discussion and no version sent lapses when its clock runs out.
Where matters live. Open matters are in the Matters menu, the ones waiting on you are on the Desk, and closed ones are in the Record. Matters are labels on entries, never containers, so a closed matter is just the record filtered to its entries.
05
The Book
The Book is your agreements as they stand today, compiled into numbered provisions. It is the current state. Click any provision and the right pane shows everything that led to it.
Reading it. The rail lists the rules by number. The page shows the text. A term with a dotted underline is a definition, click it and the definition appears in place with its version and hash. Dates and amounts come from the words as adopted, never from anywhere else.
Versions. Each provision keeps its own version. §4.3 v2 means the second wording of §4.3. When a provision is amended it keeps its number and moves to the next version. The old words stay on the record, and any decision made under them still shows the version it was made under.
The right pane. For the selected provision it shows two blocks.
The chain of authority, from the founding down to this provision, one line per link. Founding, the rule that governs this part of the book, the resolution that adopted these words, each with its date, entry number, hash and signatures. Nothing is summarised. Click a line and you see the entry itself.
Decided under this rule, every sealed matter whose authority rests on this provision, with its matter number. Click one and the matter opens. For a definition this block is Used in, every provision that cites the term.
Change. The one button on a provision. Press it and a private draft opens on the right with the current words already in it. Rewrite, press Send, and the consult stamps the door and the signers. A definition is changed the same way. The stamp tells the signers how many provisions use it.
Add provision. Opens the same page with an empty draft. Write the rule in plain words and send. Or drop a document and the compiler drafts the provisions it finds, each marked as new or as a change to an existing number. Cut what you do not want and send. If the clauses fall under different doors the stamp says so and splits them, one matter per door.
As of. The scrubber at the top replays the book to any earlier date. The same rail, the same page, shorter. Every answer the book has ever given can be reproduced this way.
06
The Record
The Record is the chain itself, grouped into registers. Nothing on this page is typed by anyone. Every row is computed from entries, and every row can be opened to the entry it came from.
The rail. Registers, grouped by what produces them.
A group that needs a capability shows a switch on its header. Off, the registers are greyed and the switch says what it costs. On, they fill from the next check. Turning one off deletes nothing, because nothing was stored, the entries it wrote stay on the chain.
Everything. The whole record in order, for auditors. Date, matter, title, outcome, entry number and hash on every row, and the head hash at the foot. This is the list everything else is made from.
Registers. A register is a small program over the entries. It has a name, columns, and a rule for which entries make its rows. The minute book is the decisions register filtered to board matters. The cap table is the holding entries replayed to today. The same renderer draws all of them, so they all read the same way.
Show me. Type what you want to see. Show me every transfer since June. Show me who can sign over $10,000. Sanctor turns the question into a register and shows it. Pin it and it joins the rail under Yours, with its definition hashed so it draws the same way next month.
As of. Every register replays to any date. Drag the control back and the cap table shows what it was on 1 June, built from the same entries, stopped earlier.
Opening a row. Click a row and the right pane shows the entry, verbatim, with its chain of authority. The matter number at the top opens the matter itself, with its stream and its sealed version.
Capabilities
A capability is a service that reads and writes to your record the way a person does. It holds a key, it is bound to a seat your book defines, and every act it makes is an ordinary entry with its signature on the face. It has no private path into the engine and no special powers.
Turning one on. In the Record, each capability is a group header with a switch. Turn it on and its registers fill. Turn it off and its key goes quiet. What it already wrote stays on the record.
What they do. Every capability produces a register you can read and acts you can see.
The agent. The Sanctor agent does two things. Each morning it checks what is open and waiting on you, which is the greeting on the Desk. And it runs the capability checks, which is where obligations and proposals come from. It never signs, never adopts, never closes a matter. If it drafts something, the draft shows up for you to send, and you can discard it.
Cost. A capability meters in the same tokens as everything else. The switch shows a rough rate. The bill is under the workspace gear.
07
People and roles
This page is a picture of who holds what, drawn from the record. It is never edited. There is no owner who adds people and no settings page for permissions.
Seats. A seat exists because a provision names it. Officer, Director, Treasurer, Secretary, Agent. The page lists every seat the book defines and who holds it, or that it is empty.
Filling a seat. Someone with the authority to appoint, under the rule that gives it, binds a person to the seat. The appointment needs the signatures that rule requires. The person then accepts by signing. Nobody is ever bound to a seat without signing their own binding. Both signatures are on the entry.
Leaving a seat. Resignation is the holder's own signature. Removal is the signatures the rule requires. Either way the seat is empty afterwards, the entry says why, and the record keeps everything the person signed while they held it.
Delegation. If a provision lets a seat delegate, the holder can bind someone else to a narrower seat. Each delegation is an entry, so the page can show the whole chain from the founders down to whoever can approve a $500 expense, and the date each link was made.
Founders. The founders are the only people not seated by a rule, because they signed the founding before there were rules. Their seats change only by a succession rule the book adopts. Nothing else can add or remove a founder.
AI agents. An agent is bound to a seat the same way a person is, acts only under the provisions that name that seat, and appears on this page beside everyone else.
As of. Replay the page to any date to see who held what then.
08
Documents
Sanctor keeps words and hashes, never files. It is not a data room and does not store your documents.
What happens to a file. Drop a file anywhere. Sanctor hashes it, extracts the words it needs onto the record, and hands the file back to you. The hash is on the entry. The words are in the stream where everyone in the matter can read them. The file itself is not kept.
Why. The purpose of the record is rules you can act on and decisions you can prove. A file in a vault is neither. The words are what the compiler reads and what the signers sign, so the words are what the record keeps.
Verifying a file later. Drop the same file again and Sanctor hashes it and looks for the hash on the record. A match means this is the file that was read on that date, byte for byte. No match means it is not. There is no third answer.
Decisions are words, not attachments. A resolution is written in the version that gets signed, not attached as a PDF. If someone sends you a resolution as a file, drop it and the words become the draft.
09
Keys and succession
You act on the record by signing with a key. The key is the identity. Your login reaches your workspaces and pays the bill, but it gives no authority on any record.
What a key can do. Whatever the book gives the seat it holds, and nothing else. A key with no seat can still confirm facts that concern it and send proposals through a door that accepts from it. It can never approve anything the rules do not let it approve.
Keeping keys. Whoever holds a key can act as it, so keep it the way you would keep a signature stamp. If you believe a key is compromised, use the rule that removes the holder from the seat, which is the removal entry on the People and roles page. There is no reset button, because a reset button would be an administrator.
Lost keys. If the keys a rule requires are lost, the things that rule governs cannot change. Nobody at Sanctor can override this. The protection against it is a succession provision in your book, adopted while the keys are still held, that says how a seat passes when its holder cannot act.
Founders. Founder seats change only by a succession rule. Write one in your first agreements. A workspace with three founders and no succession rule is a workspace that stops the day one of them disappears.
Keys on the record. Every entry shows the keys that signed it. The record never shows a name, only a key. Names are a label your workspace keeps, so a person can change their name without touching a single entry.
10
What the record guarantees
These are the promises the engine keeps, stated so you can check them without trusting us.
Append only. Entries are added at the end and never changed or removed. Each entry carries the hash of the one before it. Change any entry and every hash after it stops matching. Anyone with the list can check this with a short script.
Authority on the face. Every entry shows the signatures that authorised it and the provision they signed under. Authority is checked once, when the entry seals, and is written on the entry. It is never recomputed later, so a rule changed next year cannot change what last year's entry was allowed to do.
Chain of title. Every provision's words trace, version by version, to the document that brought them and the signatures that adopted them. Every decision traces to the provision it rests on. The panel called Chain of Authority is this trace, drawn.
Replay. The book, every past edition, who holds which seat, every register, is computed from the list of entries and nothing else. Give the list to a different program and it must arrive at the same book. If it does not, one of the programs has a bug, and the entries say which.
One exit. A matter leaves the pool exactly once, as sealed, refused, lapsed, withdrawn or superseded, and that exit is itself an entry. Nothing is half decided on the record.
The model is outside. The AI reads documents and questions and proposes words. It cannot sign, adopt, close or delete. Remove it and the record is the same record.
No administrator. There is no account that can act on a record without a key the book has seated. This includes us.
Export. You can download the full list of entries at any time. With the list you can rebuild everything in Sanctor without Sanctor.
What the record does not guarantee. It does not make a decision lawful, wise or enforceable. It shows what was signed, by whom, under which words, and when. Acting outside the rules is not prevented, it is recorded as what it was.
11
Billing
Each workspace is $149 a month, plus usage. Usage is metered in tokens and every call is metered, whether a model did the work or the engine did. Compiling, sealing, replaying and reading are normalised to a token equivalent, so a heavy replay costs more than a light read and both show on the same bill.
Every call returns what it cost. The workspace gear shows the total for the period, who pays, and the capabilities that are on. Capabilities meter the same way, so turning one on means faster burn and nothing else changes.
Billing is monthly. Cancel at any time and it ends at the close of the period. Your record stays exportable for 30 days after that.
12